Notice of Privacy Practices 

Cornerstone Pharmacy is committed to compliance with all federal and state laws that pertain to any aspect of the clinical practices or the business procedures of this pharmacy. In particular, privacy and security rules relating to the Health Insurance Portability and Accountability Act (HIPAA), along with the related state laws, are integral to matters of privacy, pharmacy records, confidentiality of communications and other topics addressed in this notice. The HIPAA Privacy Rule applies to all protected health information (PHI) in this pharmacy, including information stored and transmitted electronically, paper records and oral communications. PHI includes any information as it relates to the past, present or future physical or mental health condition of any of our customers; any prescriptions they have received; and payment information. This notice describes how medical information about patients may be used and disclosed and how patients can access this information. Please read it carefully. These procedures are in complete compliance with the Health Insurance Portability and Accountability Act (“HIPAA”). A Cornerstone Pharmacy staff member will ask you to sign an Acknowledgment that you have received this Notice of Privacy Practices (“Notice”). This Notice describes, in accordance with the HIPAA Privacy Regulation, how Cornerstone may use and disclose your PHI to carry out treatment, payment or health care operations and for other specific purposes that are permitted or required by law. The Notice also describes your rights and Cornerstone’s duties with respect to PHI about you. Cornerstone will store information provided by you in the computer system. That information will include your name, address, phone number and other identifying information. In addition, any information that you provide concerning drugs that you are taking, medical conditions you may have, allergies and other matters affecting your health will be stored in the computer.

Uses and Disclosures of Protected Health Information

Uses and Disclosures of Protected Health Information (PHI) Based Upon Your Written Consent. Once you consent to use and disclosure of your PHI for treatment, payment and health care operations by signing the consent form, your pharmacist will use or disclose your PHI as described in this Notice. Your PHI may be used and disclosed by your pharmacist, our pharmacy staff and others outside of our pharmacy that are involved in your care and treatment for the purpose of providing health care services to you.

Following are examples of the types of uses and disclosures of your PHI that the pharmacy is permitted to make once you have signed our consent form. These examples are not meant to be exhaustive, but to describe the types of uses and disclosures that may be made by our pharmacy once you have provided consent.

Treatment: We will use and disclose your PHI to provide, coordinate, or manage your health care and any related services. For example, we may disclose PHI to physicians who may be treating you when we have to obtain a new or refill prescription. Your PHI may also be provided to a physician to whom you have been referred to ensure that the physician has the necessary information to diagnose or treat you. In addition, we may disclose your PHI from time-to-time to another pharmacy or health care provider (e.g., a specialist or laboratory) who, at the request of your physician, becomes involved in your care by providing assistance with your health care diagnosis or treatment to your physician.

Payment: Your PHI will be used, as needed, to obtain payment for your health care services. This may include certain activities that your health insurance plan may undertake before it approves or pays for health care services, such as, making a determination of eligibility or coverage for insurance benefits, reviewing services provided to you for medical necessity, and undertaking utilization review activities. For example, obtaining approval for a prescription may require that your relevant PHI be disclosed to the health plan to obtain approval for the prescription.

Healthcare Operations: We may use or disclose, as-needed, your PHI in order to support the business activities of Cornerstone Pharmacy. These activities include, but are not limited to, quality assessment activities, employee review activities, training activities, licensing, marketing, and conducting or arranging for other business activities. For example, we may ask your name and your physician’s name when you deliver a prescription to be filled. We may also call you by name when your prescription is ready, and if necessary ask other information such as, but not limited to, address, date of birth or phone number, to make certain that you have the correct prescription. We may use or disclose your PHI as necessary, to contact you to remind you it is time to refill a prescription or that it is time for a follow up appointment. We may also contact you to remind you of any prescription that has not been picked up, any medication that is owed to you, any special order, to respond to a request made by you, or for any other reason that we feel necessary to provide you with continued quality care. If we are unable to speak with you directly, we may leave a message for you either on your answering machine or with a member of your family, a relative, a close friend or any other person you identify. Communications or disclosures of your PHI may be in the form of verbal communications or electronic data transmissions (internet, facsimile, or e-mail). All legal measures will be taken to ensure and protect the security of your PHI. We will share your PHI with third party “business associates” that perform various activities (e.g., billing services) for the pharmacy. Whenever an arrangement between our pharmacy and a business associate involves the use or disclosure of your PHI, we will have a written contract that contains terms that will protect the privacy of your PHI. We may use or disclose your PHI, as necessary, to provide you with information about treatment alternatives or other health-related benefits and services that may be of interest to you. We may also use and disclose your PHI for other marketing activities. For example, your name and address may be used to send you a newsletter about our pharmacy and the services we offer. We may also send you information about products or services that we believe may be beneficial to you. You may contact our Privacy Officer to request that these materials not be sent to you. Uses and disclosures of protected health information based upon your written authorization other uses and disclosures of your PHI will be made only with your written authorization, unless otherwise permitted or required by law as described below. You may revoke this authorization at any time in writing, except to the extent that your pharmacist or the pharmacy has taken an action in reliance on the use or disclosure indicated in the authorization. Other permitted and required uses and disclosures that may be made with your consent, authorization or opportunity to object. We may use and disclose your PHI in the following instances. You have the opportunity to agree or object to the use or disclosure of all or part of your PHI. If you are not present or able to agree or object to the use or disclosure of the PHI, then your pharmacist may, using professional judgment, determine whether the disclosure is in your best interest. In this case, only the PHI that is relevant to your health care will be disclosed.

Others Involved in Your Healthcare: If the “Authorization to Release Health Information” form is completed, we may disclose to a member of your family, a relative, a close friend, or any other person you identify, your PHI that directly relates to that person’s involvement in your health care. If you are unable to agree or object to such a disclosure, we may disclose such information as necessary, if we determine that it is in your best interest based on our professional judgment. We may use or disclose your PHI to an authorized public or private entity to assist in disaster relief efforts and to coordinate uses and disclosures to family or other individuals involved in your health care. To identify which person(s) you would grant access to your PHI, please request from the pharmacy, a copy of our “Authorization to Release Health Information” form, then complete and return the form to the pharmacy.

Emergencies: We may use or disclose your PHI in an emergency treatment situation. If this happens, your pharmacist shall try to obtain your consent as soon as possible after the delivery of treatment. If your pharmacist is required by law to treat you and has attempted to obtain your consent but is unable to obtain your consent, he or she may still use or disclose your PHI to treat you. This decision is at the discretion of that pharmacist providing care using the utmost professional judgment.

Communication Barriers: We may use or disclose your PHI if your pharmacist attempts to obtain consent from you but is unable to do so due to substantial communication barriers and the pharmacist determines, using professional judgment, that you intend to consent to use or disclosure under the circumstances. Other permitted and required uses and disclosures that may be made without your consent, authorization, or opportunity to object, we may use or disclose your PHI in the following situations without your consent or authorization. These situations include:

Required By Law: We may use or disclose your PHI to the extent that the use or disclosure is required by law. The use or disclosure will be made in compliance with the law and will be limited to the relevant requirements of the law. You will be notified, as required by law, of any such uses or disclosures.

Public Health: We may disclose your PHI for public health activities and purposes to a public health authority that is permitted by law to collect or receive the information. The disclosure will be made for the purpose of controlling disease, injury, or disability. We may also disclose your PHI, if directed by the public health authority, to a foreign government agency that is collaborating with the public health authority.

Health Oversight: We may disclose PHI to a health oversight agency for activities authorized by law, such as audit, investigations, and inspections. Oversight agencies seeking this information include government agencies that oversee the health care system, government benefit programs, other government regulatory programs and civil rights laws.

Abuse or Neglect: We may disclose your PHI to a public health authority that is authorized by law to receive reports of child abuse or neglect. In addition, we may disclose your PHI if we believe that you have been a victim of abuse, neglect or domestic violence to the governmental entity or agency authorized to receive such information. In this case, the disclosure will be made consistent with the requirements of applicable federal and state laws.

Food and Drug Administration: We may disclose your PHI to a person or company required by the Food and Drug Administration to report adverse events, product defects or problems, biologic product deviations, and track products; to enable product recalls; to make repairs or replacements; or to conduct post marketing surveillance, as required.

Legal Proceedings: We may disclose PHI in the course of any judicial or administrative proceeding, in response to an order of a court or administrative tribunal (to the extent such disclosure is expressly authorized), in certain conditions in response to a subpoena, discovery request or other lawful process.

Law Enforcement: We may also disclose PHI, so long as applicable legal requirements are met, for law enforcement purposes. These law enforcement purposes include (1) legal processes and otherwise required by law, (2) limited information requests for identification and location purposes, (3) pertaining to victims of a crime, (4) suspicion that death has occurred as a result of criminal conduct, (5) in the event that a crime occurs on the premises of the pharmacy and (6) medical emergency (not on the pharmacy’s premises) and it is likely that a crime has occurred.

Criminal Activity: Consistent with applicable federal and state laws, we may disclose your PHI, if we believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. We may also disclose PHI if it is necessary for law enforcement authorities to identify or apprehend an individual.

Military Activity and National Security: When the appropriate conditions apply, we may use or disclose PHI of individuals who are Armed Forces personnel (1) for activities deemed necessary by appropriate military command authorities; (2) for the purpose of a determination by the Department of Veterans Affairs of your eligibility for benefits, or (3) to foreign military authority if you are a member of that foreign military service. We may also disclose your

PHI to authorized federal officials for conducting national security and intelligence activities, including for the provision of protective services to the President or others legally authorized.

Workers Compensation: Your PHI may be disclosed by us as authorized to comply with workers compensation laws and other similar legally established programs.

Inmates: We may use or disclose your PHI if you are an inmate of a correctional facility and your pharmacy created or received your protected health information in the course of providing care to you.

Required Uses and Disclosures: Under the law, we must make disclosures to you and when required by the Secretary of the Department of Health and Human Services to investigate or determine our compliance with the requirements of Section 164.500 et. seq.